cli-forge-readme — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cli-forge-readme (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Optimization: This skill uses on-demand loading. Heavy content lives in references/ and is loaded only when needed.Language rule: Skill instructions are written in English. When generating user-facing output, detect the project's primary language (from README, comments, docs, commit messages) and produce the README in that language. If the project is bilingual, ask the user which language to use before proceeding.
Diacritics rule: When the chosen output language uses diacritics (French, Spanish, Portuguese, etc.), render them correctly — including on capitals (É, À, Ç, Ô…). Never strip accents to ASCII: write "sécurité" not "securite", "Rôle" not "Role". ASCII-flattened French is a defect, not a style.
Writing style: Favor clarity — short sentences, one idea per sentence, plain words. A metaphor only when it clarifies. Keep one consistent register (impersonal/infinitive for operational docs). Separate narrative prose, meant to make the reader understand, from telegraphic content (tables, commands, checklists) which stays terse for action.
No fabricated output: Never invent command output, console captures, API responses, metrics, or logs. When real output is needed, emit a clearly-marked placeholder (🚧 "replace with a real capture"), never plausible-but-fake text presented as real.
Generate professional README.md files where results come first, plumbing comes second.
Gotchas — read ../gotchas.md before producing output to avoid known mistakes.
A README is a landing page, not a technical manual.
Tone rule: Friendly on the surface, technical in depth.
Build the shared reconnaissance brief first — read ../shared/recon.md (what / who / problem / headline / differentiator / golden-path). The same brief feeds prez and demo, so the README, slides, and live demo tell one story.
Then read the project root to auto-detect the type:
| Signal | Project Type |
|---|---|
Cargo.toml | rust-lib or rust-cli (check [[bin]]) |
go.mod | go-lib or go-cli |
package.json | js-lib, js-app, or js-cli (check bin field) |
pyproject.toml / setup.py | python-lib or python-cli |
*.tf / terragrunt.hcl | infra-terraform |
helmfile.yaml / Chart.yaml | infra-helm |
docker-compose*.yml + app code | app-backend |
Containerfile / Dockerfile | container |
kustomization.yaml | kustomize (+flux if flux-system/) |
site.yml / playbooks/ / roles/ | ansible |
*.sh + no other code | shell-scripts |
If nothing detected → ask user with QCM (project type, language, deployment status).
Read references/pyramid.md for the detailed tier structure, rules, and badge templates.
| Tier | Audience | Content |
|---|---|---|
| 1 — Hook | Everyone | Project name, one-liner, badges, visual |
| 2 — Get Started | Most people | Quickstart (3 cmds max), features (5 max), examples with output |
| 3 — Contribute | Devs / QA | Project structure, dev setup, architecture, contributing, license |
Then apply project-type-specific adaptations. Read references/project-types.md for per-type customization.
# = project name only. ## = sections. ### = subsections. Never deeper than ####bash, rust, yaml...)RCI = Σ(wᵢ × sᵢ) / Σ(wᵢ) × 10| # | Item | Weight |
|---|---|---|
| 1 | Hook / one-liner | 5 |
| 2 | Quickstart | 5 |
| 3 | Install instructions | 4 |
| 4 | Usage examples | 4 |
| 5 | Badges | 2 |
| 6 | Project structure | 3 |
| 7 | Configuration | 3 |
| 8 | Contributing | 2 |
| 9 | License | 1 |
| 10 | Visual result | 3 |
Scoring: 0.0=absent, 0.25=stub, 0.5=exists but weak, 0.75=good, 1.0=excellent
Thresholds: 8+ excellent, 6-8 good, 4-6 needs work, <4 incomplete
README.md| Condition detected | Recommend | Why |
|---|---|---|
| Project needs full docs, not just README | /cli-forge-doc | Full documentation generation |
| Architecture diagram needed | /cli-forge-schema | Generate Mermaid |
| Commands section has untested scripts | /cli-audit-shell | Verify scripts work |
Rule: Recommend, don't auto-execute.
| Skill | Relation |
|---|---|
/cli-forge-tree | Generate the "Project Structure" section automatically |
/cli-forge-schema | Generate the diagrams embedded in the README |
/cli-forge-doc | The README is the entry point for the full documentation |
/cli-audit-doc | Audit the quality of the generated README |
/cli-audit-sync | Verify that the README stays coherent with the code |
/cli-cycle | Included in the cycle's documentation audit |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.